PT-2024-32860 · Gradio · Gradio

Ahpaleus + 1 · Published 2024-10-10 · Updated 2024-10-17 · CVE-2024-47869

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 4.44

Description This issue involves a timing attack in the way Gradio compares hashes for the analytics dashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys.

Recommendations To mitigate this issue, upgrade to Gradio version 4.44 or later. As a temporary workaround, developers can manually patch the analytics dashboard dashboard to use a constant-time comparison function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled to minimize the risk of exploitation.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

Related Identifiers

CVE-2024-47869

GHSA-J757-PF57-F8R4

PYSEC-2024-199

Affected Products

Gradio

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47869.json · Exploit
• https://osv.dev/vulnerability/GHSA-j757-pf57-f8r4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47869 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47869 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-199 · Vendor Advisory
• https://github.com/gradio-app/gradio · Note
• https://github.com/gradio-app/gradio/security/advisories/GHSA-j757-pf57-f8r4 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2024-199.yaml · Note
• https://twitter.com/CVEnew/status/1844507015462388013 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1844564333436576076 · Twitter Post
• https://t.me/cvedetector/7649 · Telegram Post
• https://t.me/cvenotify/97855 · Telegram Post